SUMMARY: Runaway Ethernet card?

From: John S. McLaughlin [Citibank NAGF] (
Date: Wed Mar 20 1996 - 08:46:51 CST

Hi Managers,

   My thanks to all who replied to my original query:

> Could someone tell me the most likely reason for the following message
> to appear in /var/adm/messages? I've never seen the like.

> seawall unix: IP: Hardware address '08:00:20:23:51:48' trying to be our
> address!

  The overwhelming consensus was that there was a system on our network
which had appropriated "seawall's" IP address and that ARP was reporting the
alert to /var/adm/messages.

I initially thought the same thing, that a PC or somesuch had been attached to
the network using seawall's IP address. However, the ethernet address being
reported was in-fact seawall's address. The problem has not reappeared since
the original event(s).

At any rate, for diagnosing problems of this sort, a few respondents had
some advice to offer in trouble shooting:

>From Steve Phelps <>:

> To check whether this is in fact caused by duplicate IP try the
> following test:
> ifconfig 159.17.5.XX
> where XX is an address definately NOT used.
> If errors go away then it is almost certainly caused by duplicate IP.

Another suggestion from Steve was to dump the ARP tables (arp -a) to get
the current MAC->IP translations that the server knows about.

>From Ray <> comes first hand experience in this situation
where the problem turned out to be a faulty cabletron hub port. He recommends
checking hub port, cabling and patch revisions.

>From Perry Hutchison <>, a more arcane suggestion:

> More far-fetched, maybe some router is trying to proxy-arp for it but
> on its own network (which is a no-no), however this should not cause it
> to report its own Ethernet address as the source of the bogus broadcast.

>From Adam Nevins <> and Aggelos P. Varvitsiotis
<> comes the reccomendation to use "snoop" or
"etherfind" to ferret out the culprit machine.

Again, my thanks to all who responded:


     John S. Mclaughlin           | "Can you tell me please, which way
     Citibank Delaware		  |     to go from here?" asked Alice. 
     (302) 324-6491               | "That depends a good deal on where    |     You want to go," said the Queen.

This archive was generated by hypermail 2.1.2 : Fri Sep 28 2001 - 23:10:55 CDT